Anthropic Publicly Discloses Engineering Countermeasures Against Distillation Attacks for the First Time, Cutting Theft by 90%-99%

On October 12, 2026, Anthropic released a distillation defense research report detailing how three engineering defense lines reduced model theft by 90%-99%.

Factual Reconstruction

The report states that distillation attacks use networks of fraudulent accounts to extract Claude's capabilities at scale and reproduce them in unauthorized models. Earlier simple measures, such as requiring Claude to first summarize its reasoning, already reduced a distilled model's score on the SWE-bench Verified benchmark from 80.4% to 71.8%. Attackers then shifted to active extraction, attempting to induce the model to output its complete hidden reasoning process. Anthropic therefore built detection mechanisms to identify complete-reasoning extraction requests that ordinary users rarely make.

Mechanism Breakdown

The three engineering defense lines include locking access to reasoning tokens (preserved thinking), a two-stage classifier that bans accounts in real time (with a false-positive rate below 0.1%), and charging for intercepted requests. Tens of thousands of extraction accounts have been banned, and reasoning token leakage has fallen by a factor of 10-100 compared with before the defenses. These measures directly target the reliance on reasoning traces in industrial-scale distillation attacks.

Industry Impact

The upgraded defenses led Anthropic to turn down substantial revenue and trillions of tokens in paid traffic from distillers, while requiring legitimate users to update their integration methods. Labs such as Zhipu had attempted to distill the cyber capabilities of Claude Fable 5, then turned to other models after the protections were downgraded. Distilled models such as GLM-5.3 are assessed as among the open-weight models with the strongest cyber capabilities, and their protections are easy to bypass.

Strategic Judgment (Analysis, Not Fact)

From the perspective of honoring agreements, this move escalates terms-of-use constraints into technical forced containment, echoing the issue of AI boundary compliance in the WDCD evaluation. This is the first time a leading lab has publicly quantified the effects of engineering countermeasures, which may prompt other developers to assess similar trade-offs: the balance between short-term revenue loss and long-term capability protection. Historical precedent shows that compliance discussions alone can hardly stop large-scale extraction, whereas engineering measures act directly on the data acquisition stage.